Allons-y! is designed for children. We take children's privacy extremely seriously and comply with the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario privacy regulations, and the principles of the U.S. Children's Online Privacy Protection Act (COPPA).
1. Who We Are
Allons-y! is operated by BottleneckLabs.ai ("we", "us", "our"). We are the data controller responsible for your personal information.
Contact: privacy@bottlenecklabs.ai
2. Information We Collect
2.1 Information provided at registration
- Student email address — used for authentication and account recovery
- Password — stored in hashed form; we never have access to your plaintext password
- Parent/guardian email address — collected during registration to enable parent communication and verify consent
2.2 Information generated through use
- Exercise scores and progress — best scores, attempt counts, completion dates
- XP totals and streak data — gamification metrics
- Application settings — preferences like TTS and subtitle toggles
2.3 Information processed by AI features
- Exercise answers — sent to Anthropic's Claude API when using the "Pourquoi?" explanation feature
- Conversation messages — sent to the Claude API during conversation practice sessions
- Exercise performance data — used for adaptive exercise generation
2.4 Information we do NOT collect
- Full legal names or physical addresses
- Phone numbers
- Photos, videos, or voice recordings
- Location data or GPS coordinates
- Device identifiers or advertising IDs
- Social media account information
- Financial or payment information
3. How We Use Your Information
We use collected information strictly for the following purposes:
- Provide the educational service — authenticate users, save and sync learning progress across devices
- Power AI features — generate explanations, adaptive exercises, and conversation practice
- Communicate with parents/guardians — send account-related notifications to the parent email on file
- Improve the application — understand usage patterns to improve content and features (aggregated, non-identifying data only)
We do not use personal information for advertising, marketing to children, profiling, or any purpose unrelated to the educational service.
4. Third-Party Services
We use the following third-party services to operate Allons-y!:
- Supabase (auth.supabase.com) — authentication and database hosting. Supabase processes email addresses and hashed passwords. Data is stored in the United States (Virginia). Supabase Privacy Policy
- Anthropic (api.anthropic.com) — AI explanations, adaptive exercise generation, and conversation practice. Exercise content and student responses are sent to Anthropic's API for processing. Anthropic does not use API inputs to train its models. Anthropic Privacy Policy
- Vercel — application hosting and deployment. Vercel may process standard server logs (IP addresses, request timestamps). Vercel Privacy Policy
We do not sell, rent, trade, or otherwise share personal information with any third party for their own marketing or commercial purposes.
5. Data Storage & Security
- Local storage — without an account, all data is stored only in your browser's localStorage and never leaves your device
- Cloud storage — with an account, data is stored in Supabase's managed PostgreSQL database with row-level security (RLS) ensuring users can only access their own data
- Encryption — all data in transit is encrypted via TLS/HTTPS. Passwords are hashed using industry-standard algorithms (bcrypt)
- Access controls — database access is restricted by RLS policies. API keys are stored as server-side environment variables and are never exposed to the client
6. Children's Privacy
We recognize the importance of protecting children's privacy:
- We collect only the minimum information necessary to provide the educational service
- Account creation requires a parent/guardian email address
- We do not display advertising of any kind
- We do not enable social features, public profiles, or communication between users
- We do not condition a child's participation on the collection of more personal information than is reasonably necessary
- AI conversation features are designed to be age-appropriate and educational in nature
- Parents/guardians may request access to, correction of, or deletion of their child's personal information at any time by contacting us
7. Cookies & Tracking
Allons-y! does not use third-party cookies, advertising trackers, analytics trackers, or pixel tags. The only browser storage we use is:
- localStorage — to persist learning progress and app settings on your device
- Authentication cookies — essential session cookies set by Supabase to maintain your login session (if you have an account)
8. Data Retention
- Account data is retained for as long as the account is active
- AI conversation data is processed in real-time and is not permanently stored by us or Anthropic
- Upon account deletion, all associated personal data is permanently removed from our systems within 30 days
- localStorage data can be cleared at any time by the user through their browser settings
9. Your Rights
Under applicable Canadian privacy law (PIPEDA) and Ontario regulations, you (or a parent/guardian on behalf of a child) have the right to:
- Access — request a copy of the personal information we hold about you or your child
- Correction — request correction of inaccurate personal information
- Deletion — request deletion of your account and all associated data
- Withdrawal of consent — withdraw consent for data processing at any time (which may require account closure)
- Complaint — file a complaint with the Office of the Privacy Commissioner of Canada
To exercise any of these rights, contact us at privacy@bottlenecklabs.ai. We will respond within 30 days.
10. International Data Transfers
Your data may be processed in the United States through our third-party service providers (Supabase, Anthropic, Vercel). By using Allons-y!, you consent to the transfer of your information to the United States, where data protection laws may differ from those in Canada. We ensure that all service providers maintain appropriate security measures.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify parents/guardians via the email address on file and update the "Last updated" date above. Continued use of the application after changes constitutes acceptance of the revised policy.
12. Contact Us
For any privacy-related questions, concerns, or requests:
BottleneckLabs.ai
Privacy Officer
Email: privacy@bottlenecklabs.ai